diff --git a/Manifests/Manifest_LAOS-18.1.xml b/Manifests/Manifest_LAOS-18.1.xml
index a47bb297..edc64d01 100644
--- a/Manifests/Manifest_LAOS-18.1.xml
+++ b/Manifests/Manifest_LAOS-18.1.xml
@@ -71,8 +71,8 @@
-
+
+
diff --git a/Patches/LineageOS-16.0/android_external_hardened_malloc/0001-Broken_Audio.patch b/Patches/LineageOS-16.0/android_external_hardened_malloc/0001-Broken_Audio.patch
new file mode 100644
index 00000000..04d13455
--- /dev/null
+++ b/Patches/LineageOS-16.0/android_external_hardened_malloc/0001-Broken_Audio.patch
@@ -0,0 +1,66 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay
+Date: Thu, 28 May 2020 20:19:14 -0400
+Subject: [PATCH] workaround for audio service sorting bug
+
+---
+ h_malloc.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/h_malloc.c b/h_malloc.c
+index 8d15ab2..dbedbd4 100644
+--- a/h_malloc.c
++++ b/h_malloc.c
+@@ -85,6 +85,7 @@ static union {
+ bool zero_on_free;
+ bool purge_slabs;
+ bool region_quarantine_protect;
++ bool slot_randomize;
+ };
+ char padding[PAGE_SIZE];
+ } ro __attribute__((aligned(PAGE_SIZE)));
+@@ -355,7 +356,7 @@ static u64 get_mask(size_t slots) {
+ }
+
+ static size_t get_free_slot(struct random_state *rng, size_t slots, struct slab_metadata *metadata) {
+- if (SLOT_RANDOMIZE) {
++ if (ro.slot_randomize) {
+ // randomize start location for linear search (uniform random choice is too slow)
+ unsigned random_index = get_random_u16_uniform(rng, slots);
+ unsigned first_bitmap = random_index / 64;
+@@ -1061,17 +1062,24 @@ static inline void enforce_init(void) {
+ }
+ }
+
+-COLD static void handle_hal_bugs(void) {
++COLD static void handle_bugs(void) {
+ char path[256];
+ if (readlink("/proc/self/exe", path, sizeof(path)) == -1) {
+ return;
+ }
++
+ const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
+ if (strcmp(camera_provider, path) == 0) {
+ ro.zero_on_free = false;
+ ro.purge_slabs = false;
+ ro.region_quarantine_protect = false;
+ }
++
++ // DeviceDescriptor sorting wrongly relies on malloc addresses
++ const char audio_service[] = "/system/bin/audioserver";
++ if (strcmp(audio_service, path) == 0) {
++ ro.slot_randomize = false;
++ }
+ }
+
+ COLD static void init_slow_path(void) {
+@@ -1100,7 +1108,8 @@ COLD static void init_slow_path(void) {
+ ro.purge_slabs = true;
+ ro.zero_on_free = ZERO_ON_FREE;
+ ro.region_quarantine_protect = true;
+- handle_hal_bugs();
++ ro.slot_randomize = SLOT_RANDOMIZE;
++ handle_bugs();
+
+ if (sysconf(_SC_PAGESIZE) != PAGE_SIZE) {
+ fatal_error("page size mismatch");
diff --git a/Patches/LineageOS-16.0/android_external_hardened_malloc/0002-Broken_Cameras.patch b/Patches/LineageOS-16.0/android_external_hardened_malloc/0002-Broken_Cameras.patch
new file mode 100644
index 00000000..7049d433
--- /dev/null
+++ b/Patches/LineageOS-16.0/android_external_hardened_malloc/0002-Broken_Cameras.patch
@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad
+Date: Tue, 15 Mar 2022 22:18:26 -0400
+Subject: [PATCH] Expand workaround to all camera executables
+
+Signed-off-by: Tad
+---
+ h_malloc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/h_malloc.c b/h_malloc.c
+index dbedbd4..ebf5d76 100644
+--- a/h_malloc.c
++++ b/h_malloc.c
+@@ -1068,8 +1068,8 @@ COLD static void handle_bugs(void) {
+ return;
+ }
+
+- const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
+- if (strcmp(camera_provider, path) == 0) {
++ // Any camera executable on system partition
++ if (strstr(path, "camera") != NULL && (strncmp("/system", path, 7) == 0 || strncmp("/vendor", path, 7) == 0)) {
+ ro.zero_on_free = false;
+ ro.purge_slabs = false;
+ ro.region_quarantine_protect = false;
diff --git a/Patches/Common/android_frameworks_av/0001-HM-No_RLIMIT_AS.patch b/Patches/LineageOS-16.0/android_frameworks_av/0001-HM-No_RLIMIT_AS.patch
similarity index 100%
rename from Patches/Common/android_frameworks_av/0001-HM-No_RLIMIT_AS.patch
rename to Patches/LineageOS-16.0/android_frameworks_av/0001-HM-No_RLIMIT_AS.patch
diff --git a/Patches/LineageOS-17.1/android_external_hardened_malloc/0001-Broken_Cameras.patch b/Patches/LineageOS-17.1/android_external_hardened_malloc/0001-Broken_Cameras.patch
new file mode 100644
index 00000000..e5f198f2
--- /dev/null
+++ b/Patches/LineageOS-17.1/android_external_hardened_malloc/0001-Broken_Cameras.patch
@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad
+Date: Tue, 15 Mar 2022 22:18:26 -0400
+Subject: [PATCH] Expand workaround to all camera executables
+
+Signed-off-by: Tad
+---
+ h_malloc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/h_malloc.c b/h_malloc.c
+index de693c9..95a6ba3 100644
+--- a/h_malloc.c
++++ b/h_malloc.c
+@@ -1057,8 +1057,8 @@ COLD static void handle_bugs(void) {
+ return;
+ }
+
+- const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
+- if (strcmp(camera_provider, path) == 0) {
++ // Any camera executable on system partition
++ if (strstr(path, "camera") != NULL && (strncmp("/system", path, 7) == 0 || strncmp("/vendor", path, 7) == 0)) {
+ ro.zero_on_free = false;
+ ro.purge_slabs = false;
+ ro.region_quarantine_protect = false;
diff --git a/Patches/LineageOS-17.1/android_frameworks_av/0001-HM_A2DP_Fix.patch b/Patches/LineageOS-17.1/android_frameworks_av/0001-HM_A2DP_Fix.patch
deleted file mode 100644
index 7a5d3359..00000000
--- a/Patches/LineageOS-17.1/android_frameworks_av/0001-HM_A2DP_Fix.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Oscar Mira
-Date: Sun, 10 May 2020 01:56:34 +0200
-Subject: [PATCH] Fix AudioPolicy device entries order to support
- SLOT_RANDOMIZE
-
-Fix GrapheneOS/os_issue_tracker#137
----
- .../include/DeviceDescriptor.h | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
-diff --git a/services/audiopolicy/common/managerdefinitions/include/DeviceDescriptor.h b/services/audiopolicy/common/managerdefinitions/include/DeviceDescriptor.h
-index 33e506f1b7..5f9f8b558c 100644
---- a/services/audiopolicy/common/managerdefinitions/include/DeviceDescriptor.h
-+++ b/services/audiopolicy/common/managerdefinitions/include/DeviceDescriptor.h
-@@ -206,6 +206,22 @@ public:
-
- void dump(String8 *dst, const String8 &tag, int spaces = 0, bool verbose = true) const;
-
-+protected:
-+ // Sorts devices by type.
-+ int do_compare(const void* lhs, const void* rhs) const override
-+ {
-+ const auto& l = *reinterpret_cast*>(lhs);
-+ const auto& r = *reinterpret_cast*>(rhs);
-+
-+ audio_devices_t lt = l->type();
-+ audio_devices_t rt = r->type();
-+
-+ if (lt == rt) {
-+ return 0;
-+ }
-+ return lt > rt ? 1 : -1;
-+ }
-+
- private:
- void refreshTypes();
- audio_devices_t mDeviceTypes;
diff --git a/Patches/LineageOS-18.1/android_external_hardened_malloc/0001-Broken_Cameras.patch b/Patches/LineageOS-18.1/android_external_hardened_malloc/0001-Broken_Cameras.patch
new file mode 100644
index 00000000..58af8b96
--- /dev/null
+++ b/Patches/LineageOS-18.1/android_external_hardened_malloc/0001-Broken_Cameras.patch
@@ -0,0 +1,26 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad
+Date: Tue, 15 Mar 2022 22:18:26 -0400
+Subject: [PATCH] Expand workaround to all camera executables
+
+Signed-off-by: Tad
+---
+ h_malloc.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/h_malloc.c b/h_malloc.c
+index a6e1a7c..662af35 100644
+--- a/h_malloc.c
++++ b/h_malloc.c
+@@ -1068,9 +1068,8 @@ COLD static void handle_bugs(void) {
+ return;
+ }
+
+- // Pixel 3, Pixel 3 XL, Pixel 3a and Pixel 3a XL camera provider
+- const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
+- if (strcmp(camera_provider, path) == 0) {
++ // Any camera executable on system partition
++ if (strstr(path, "camera") != NULL && (strncmp("/system", path, 7) == 0 || strncmp("/vendor", path, 7) == 0)) {
+ ro.zero_on_free = false;
+ ro.purge_slabs = false;
+ ro.region_quarantine_protect = false;
diff --git a/Scripts/LineageOS-16.0/Patch.sh b/Scripts/LineageOS-16.0/Patch.sh
index ed5ddbf3..2f2c393e 100644
--- a/Scripts/LineageOS-16.0/Patch.sh
+++ b/Scripts/LineageOS-16.0/Patch.sh
@@ -119,6 +119,13 @@ if enterAndClear "external/conscrypt"; then
if [ "$DOS_GRAPHENE_CONSTIFY" = true ]; then applyPatch "$DOS_PATCHES/android_external_conscrypt/0001-constify_JNINativeMethod.patch"; fi; #Constify JNINativeMethod tables (GrapheneOS)
fi;
+if [ "$DOS_GRAPHENE_MALLOC" = true ]; then
+if enterAndClear "external/hardened_malloc"; then
+applyPatch "$DOS_PATCHES/android_external_hardened_malloc/0001-Broken_Audio.patch"; #DeviceDescriptor sorting wrongly relies on malloc addresses (GrapheneOS)
+applyPatch "$DOS_PATCHES/android_external_hardened_malloc/0002-Broken_Cameras.patch"; #Expand workaround to all camera executables
+fi;
+fi;
+
if enterAndClear "external/svox"; then
git revert --no-edit 1419d63b4889a26d22443fd8df1f9073bf229d3d; #Add back Makefiles
sed -i '12iLOCAL_SDK_VERSION := current' pico/Android.mk; #Fix build under Pie
@@ -127,7 +134,7 @@ awk -i inplace '!/deletePackage/' pico/src/com/svox/pico/LangPackUninstaller.jav
fi;
if enterAndClear "frameworks/av"; then
-if [ "$DOS_GRAPHENE_MALLOC" = true ]; then applyPatch "$DOS_PATCHES_COMMON/android_frameworks_av/0001-HM-No_RLIMIT_AS.patch"; fi; #(GrapheneOS)
+if [ "$DOS_GRAPHENE_MALLOC" = true ]; then applyPatch "$DOS_PATCHES/android_frameworks_av/0001-HM-No_RLIMIT_AS.patch"; fi; #(GrapheneOS)
fi;
if enterAndClear "frameworks/base"; then
diff --git a/Scripts/LineageOS-17.1/Patch.sh b/Scripts/LineageOS-17.1/Patch.sh
index d118edf7..5f628188 100644
--- a/Scripts/LineageOS-17.1/Patch.sh
+++ b/Scripts/LineageOS-17.1/Patch.sh
@@ -116,6 +116,12 @@ if enterAndClear "external/conscrypt"; then
if [ "$DOS_GRAPHENE_CONSTIFY" = true ]; then applyPatch "$DOS_PATCHES/android_external_conscrypt/0001-constify_JNINativeMethod.patch"; fi; #Constify JNINativeMethod tables (GrapheneOS)
fi;
+if [ "$DOS_GRAPHENE_MALLOC" = true ]; then
+if enterAndClear "external/hardened_malloc"; then
+applyPatch "$DOS_PATCHES/android_external_hardened_malloc/0001-Broken_Cameras.patch"; #Expand workaround to all camera executables
+fi;
+fi;
+
if enterAndClear "external/svox"; then
git revert --no-edit 1419d63b4889a26d22443fd8df1f9073bf229d3d; #Add back Makefiles
sed -i '12iLOCAL_SDK_VERSION := current' pico/Android.mk; #Fix build under Pie
@@ -123,10 +129,6 @@ sed -i 's/about to delete/unable to delete/' pico/src/com/svox/pico/LangPackUnin
awk -i inplace '!/deletePackage/' pico/src/com/svox/pico/LangPackUninstaller.java;
fi;
-if enterAndClear "frameworks/av"; then
-if [ "$DOS_GRAPHENE_MALLOC" = true ]; then applyPatch "$DOS_PATCHES/android_frameworks_av/0001-HM_A2DP_Fix.patch"; fi; #(GrapheneOS)
-fi;
-
if enterAndClear "frameworks/base"; then
#applyPatch "$DOS_PATCHES/android_frameworks_base/0006-Disable_Analytics.patch"; #Disable/reduce functionality of various ad/analytics libraries
applyPatch "$DOS_PATCHES/android_frameworks_base/0007-Always_Restict_Serial.patch"; #Always restrict access to Build.SERIAL (GrapheneOS)
diff --git a/Scripts/LineageOS-18.1/Patch.sh b/Scripts/LineageOS-18.1/Patch.sh
index 47549553..b4b860cc 100644
--- a/Scripts/LineageOS-18.1/Patch.sh
+++ b/Scripts/LineageOS-18.1/Patch.sh
@@ -60,7 +60,7 @@ if [ "$DOS_GRAPHENE_CONSTIFY" = true ]; then applyPatch "$DOS_PATCHES/android_ar
fi;
if enterAndClear "bionic"; then
-#if [ "$DOS_GRAPHENE_MALLOC" = true ]; then applyPatch "$DOS_PATCHES/android_bionic/0001-HM-Use_HM.patch"; fi; #(GrapheneOS) #XXX: needs to be verified
+if [ "$DOS_GRAPHENE_MALLOC" = true ]; then applyPatch "$DOS_PATCHES/android_bionic/0001-HM-Use_HM.patch"; fi; #(GrapheneOS)
if [ "$DOS_GRAPHENE_BIONIC" = true ]; then
applyPatch "$DOS_PATCHES/android_bionic/0002-Graphene_Bionic_Hardening-1.patch"; #Add a real explicit_bzero implementation (GrapheneOS)
applyPatch "$DOS_PATCHES/android_bionic/0002-Graphene_Bionic_Hardening-2.patch"; #Replace brk and sbrk with stubs (GrapheneOS)
@@ -98,7 +98,7 @@ fi;
if enterAndClear "build/soong"; then
applyPatch "$DOS_PATCHES/android_build_soong/0001-Enable_fwrapv.patch"; #Use -fwrapv at a minimum (GrapheneOS)
-#if [ "$DOS_GRAPHENE_MALLOC" = true ]; then applyPatch "$DOS_PATCHES/android_bionic/0002-hm_apex.patch"; fi; #(GrapheneOS)
+if [ "$DOS_GRAPHENE_MALLOC" = true ]; then applyPatch "$DOS_PATCHES/android_bionic/0002-hm_apex.patch"; fi; #(GrapheneOS)
fi;
if enterAndClear "device/qcom/sepolicy-legacy"; then
@@ -115,6 +115,12 @@ if enterAndClear "external/conscrypt"; then
if [ "$DOS_GRAPHENE_CONSTIFY" = true ]; then applyPatch "$DOS_PATCHES/android_external_conscrypt/0001-constify_JNINativeMethod.patch"; fi; #Constify JNINativeMethod tables (GrapheneOS)
fi;
+if [ "$DOS_GRAPHENE_MALLOC" = true ]; then
+if enterAndClear "external/hardened_malloc"; then
+applyPatch "$DOS_PATCHES/android_external_hardened_malloc/0001-Broken_Cameras.patch"; #Expand workaround to all camera executables
+fi;
+fi;
+
if enterAndClear "frameworks/base"; then
#applyPatch "$DOS_PATCHES/android_frameworks_base/0006-Disable_Analytics.patch"; #Disable/reduce functionality of various ad/analytics libraries
applyPatch "$DOS_PATCHES/android_frameworks_base/0007-Always_Restict_Serial.patch"; #Always restrict access to Build.SERIAL (GrapheneOS)
@@ -340,7 +346,7 @@ if [ "$DOS_HOSTS_BLOCKING" = true ]; then cat "$DOS_HOSTS_FILE" >> rootdir/etc/h
git revert --no-edit e8dcabaf6b55ec55eb73c4585501ddbafc04fc9b 79f606ece6b74652d374eb4f79de309a0aa81360; #insanity
applyPatch "$DOS_PATCHES/android_system_core/0001-Harden.patch"; #Harden mounts with nodev/noexec/nosuid + misc sysctl changes (GrapheneOS)
if [ "$DOS_GRAPHENE_PTRACE_SCOPE" = true ]; then applyPatch "$DOS_PATCHES/android_system_core/0002-ptrace_scope.patch"; fi; #Add a property for controlling ptrace_scope (GrapheneOS)
-#if [ "$DOS_GRAPHENE_MALLOC" = true ]; then applyPatch "$DOS_PATCHES/android_system_core/0003-HM-Increase_vm_mmc.patch"; fi; #(GrapheneOS)
+if [ "$DOS_GRAPHENE_MALLOC" = true ]; then applyPatch "$DOS_PATCHES/android_system_core/0003-HM-Increase_vm_mmc.patch"; fi; #(GrapheneOS)
if [ "$DOS_GRAPHENE_BIONIC" = true ]; then applyPatch "$DOS_PATCHES/android_system_core/0004-Zero_Sensitive_Info.patch"; fi; #Zero sensitive information with explicit_bzero (GrapheneOS)
fi;
diff --git a/Scripts/init.sh b/Scripts/init.sh
index d87bc3af..bc0a15be 100644
--- a/Scripts/init.sh
+++ b/Scripts/init.sh
@@ -60,7 +60,7 @@ export DOS_GPS_GLONASS_FORCED=false; #Enables GLONASS on all devices
export DOS_GRAPHENE_BIONIC=true; #Enables the bionic hardening patchset on 16.0+17.1+18.1
export DOS_GRAPHENE_CONSTIFY=true; #Enables 'Constify JNINativeMethod tables' patchset on 16.0+17.1+18.1
export DOS_GRAPHENE_MALLOC=true; #Enables use of GrapheneOS' hardened memory allocator on 64-bit platforms on 16.0+17.1+18.1
-export DOS_GRAPHENE_EXEC=false; #Enables use of GrapheneOS' exec spawning feature on 16.0+17.1+18.1 XXX: broken (just on 17.1?)
+export DOS_GRAPHENE_EXEC=false; #Enables use of GrapheneOS' exec spawning feature on 16.0+17.1+18.1 XXX: breaks things like VoLTE
export DOS_GRAPHENE_PTRACE_SCOPE=true; #Enables the ptrace_scope toggle patchset on 18.1
export DOS_GRAPHENE_NETWORK_PERM=true; #Enables use of GrapheneOS' NETWORK permission on 17.1+18.1
export DOS_HOSTS_BLOCKING=true; #Set false to prevent inclusion of a HOSTS file